> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigation-notes-template.md).

# Investigation Notes Template

Use this simple format when documenting a ZyberLab investigation.

## Investigation Title

Describe the activity being reviewed.

Example:

```
Failed Logon Investigation on CLIENT01
```

## Date and Time

Record the investigation date and the event time window.

```
Investigation date:
Event window:
```

## Systems Involved

Record the systems involved.

```
DC01
CLIENT01
KALI01
```

Include only the systems relevant to the investigation.

## Initial Observation

Write one or two sentences describing what caused you to investigate.

Example:

```
Multiple failed logons were observed for labuser01 on CLIENT01.
The activity was reviewed to confirm the source and determine whether a successful sign-in followed.
```

## Evidence Reviewed

Record the main evidence sources.

Examples include:

* Windows Security log
* Sysmon Operational log
* Active Directory audit events
* netstat output
* system and user context

## Key Events

| Time | System | Event ID or Source | Observation |
| ---- | ------ | ------------------ | ----------- |
|      |        |                    |             |
|      |        |                    |             |
|      |        |                    |             |

## Investigation Questions

Answer these questions where relevant:

1. What happened?
2. Which account was involved?
3. Which system was involved?
4. What happened immediately before and after the event?
5. Was the activity expected?
6. Was any cleanup required?

## Finding

Summarize the evidence in clear language.

```
Finding:
```

## Classification

Choose a simple lab classification:

```
Expected Lab Activity
Benign Activity
Needs More Investigation
```

## Cleanup or Follow-Up

Record any cleanup performed, such as:

* removing temporary group membership
* unlocking a test account
* deleting a temporary user
* closing test applications
* restoring the expected lab state

## Key Lesson

Write one short lesson learned from the investigation.

The objective is to build the habit of producing clear, repeatable, evidence-based investigation notes.